I have never seen an organization open its manual the moment a crisis strikes. It is not because they lack one. Most companies have a manual. Ones exceeding 100 pages are common. Yet when a crisis actually hits, no one looks for it. It is too thick. A thick document sells reassurance rather than preparedness. The moment a manual is completed, an organization believes its preparation is over. That belief is the most dangerous of all.
On September 26 last year, a fire broke out at the National Information Resources Service in Daejeon. It happened while lithium-ion batteries were being moved. The government said it would restore operations quickly. But even after four days, the recovery was not finished. By mid-October, fewer than half of the systems had been normalized. Government24 went down, and the e-People civil complaint portal went down. At the parliamentary audit, the head of the agency answered as follows. There was a manual for a fire in the battery room. But there was no manual for the work of moving the batteries.
Everything is contained in that single sentence. A manual is a document that records anticipated accidents. A crisis arrives from a place no one anticipated. And so documents and crises rarely meet. A thick manual is less a product of preparation than a product of dispersed responsibility. The more items there are, the more people are put in charge, and the more people are put in charge, the more decisions are delayed. A document only reassures an organization; it does not make the decision for you.
Nor was there any lack of warning. The Board of Audit and Inspection had already pointed out the problem back in 2024. Its finding was that the majority of the work systems managed by this agency lacked a disaster recovery framework. Even looking only at high-priority systems, a considerable number had no recovery framework. The problem raised after the 2022 Pangyo data center fire was repeated exactly as before. The warning was there. It simply went unread.
Having a manual and having a manual that works are different things. Even an unprepared organization moves when a crisis strikes. But that is not a response; it is a reaction. A reaction is fast, but it has no direction.
So what is preparation? It is not the thickness of a document. It is the speed of judgment. It is the time it takes, when an incident breaks out, to determine whether it is a legal liability, a moral responsibility, an internal failure, or an external threat. An organization that finishes this classification within 30 minutes and one that takes three days meet different endings. Once the type is determined, a stance can be set, and only once a stance is set can words come out. Words that skip this order are always retracted.
The only way to move a document into the body is training. Writing down how to swim does not allow a person who cannot swim to float on water. A drowning person does not open a document. No, they cannot open one. What saves them is not a thick book but arms and legs that have practiced swimming all along.
The effect of crisis-response training has already been verified. In the cyber crisis-response drills conducted by the Korea Internet & Security Agency in the first half of last year, companies that participated repeatedly had lower malware infection rates than companies participating for the first time. Their speed in detecting attacks was also more than twice as fast. These were organizations with the same guidelines. The difference lay in how many times they had trained. It was not what they had learned but what they had practiced that worked.
Training is not a procedure for confirming the manual. It is a procedure for discovering that the manual is wrong. You come to know this only by doing it yourself. The calls do not connect, the decision-maker is not in their seat, and the door opens the opposite way. These are things invisible on paper. An organization that has never trained learns them for the first time only on the day the crisis occurs.
So why do they not train? It is not for lack of knowledge. Training costs people, time, and money, yet its effect is difficult to prove as visible results. A crisis that has been prevented no longer looks like a crisis. The crisis of a prepared organization ends small, and a crisis that ends small is remembered by no one. The world remembers only the names of companies that collapsed.
No company has escaped crisis. There are only companies whose turn has not yet come. Manuals do not get opened in a crisis. What gets opened that day is only what the organization has practiced all along.
